Meta's Muse vs Grok Bot
Meta's Muse vs Grok Bot
Meta shipped one agent and a locked-down computer. SpaceXAI shipped a roster that shares one.
On September 8, 2026, Meta published Introducing Muse: The World’s First Personal AI Agent Built for Everyone.
What the announcement actually says
Muse is a personal agent you message, in a Muse app or inside WhatsApp. It runs on Muse Secure VM, a dedicated virtual machine for the agent and the person's data, powered by Muse Spark. You give it a task or a longer goal. It can plan, open a browser, fill a form, and negotiate. It keeps going after the app closes, and it stops for approval before it sends an email or pays.
Checkout goes through Link, Stripe's wallet for agents. Meta says Muse is the first agent covered by Link's purchase protections, and that Link issues a one-time card so the real card stays hidden. Shop Pay and 1Password are named as coming later. The rollout is the United States, on iOS, Android, and muse.ai, with AI glasses later. It is free for most of what people need, with subscriptions past that. People can opt out of training, and the post says Muse does not share conversations or VM data with Meta's ad systems.
Source: Introducing Muse, Meta Newsroom, September 8, 2026.
Two companion pieces landed the same day. How We Designed Muse, by Mona Sarantakos with Christine Awad, is the product essay. How We Built Safety Into Muse, by Tarek Sheasha, describes the machine. Muse the agent is separate from Muse Spark the model, the checkpoint covered in Can Muse Spark 1.3 win developers after Llama?.
The computer Meta is selling
Sheasha's post is the half of the launch that describes the machine. Meta had been using Muse internally since early 2026. Handing it an inbox, a calendar, and a shell "didn't always work out as planned." The design assumes the agent will make mistakes and will sometimes be attacked through the data it reads.
The architecture in that post:
- Each person gets a dedicated Linux VM. The client apps connect to that VM.
- The agent harness runs in a container. Root inside the container maps to an unprivileged user. Credentials live outside that cell.
- A separate Sentinel, which the agent cannot override, is the only thing that can approve a connector action or a network request.
- The model sees a surrogate token. Sentinel swaps in the real credential at the boundary, after the request is allowed.
- Approvals show up in the client, outside the chat, so a poisoned page cannot talk the person into tapping yes inside the conversation.
- The email connector filters one-time codes, password-reset links, and magic login links.
- A bug bounty opened with the launch, up to $300,000, including up to $130,000 for a prompt injection that affects one user.
Source: How We Built Safety Into Muse, Tarek Sheasha, Meta AI Research, September 8, 2026.
Around that diagram, the newsroom post says people choose which apps connect, including whether email can send or only be read. They can disconnect, and they can tell Muse to forget something. Later in 2026 Meta says it will ship Muse Confidential VM, with the VM encrypted under a key only the person holds. The design essay shows the day-to-day version of that: goals on a list, and a purchase that stops on Allow or Deny. Prompt injection stays an open problem. The harness is there to bound it.
Source: How We Designed Muse.
Source: How We Designed Muse. Meta's announcement says Link is the checkout path, with purchase protections.
Set next to Grok Bot
Grok Bot launched on August 11, 2026, about four weeks earlier. It is a roster. You create teammates with names and jobs. They share a computer in Cursor's cloud, message each other, and pass work. A Routine runs on a schedule. You teach a skill by walking the Bot through the path once.
Source: Grok Bot 101, SpaceXAI.
The computer docs draw the boundary Meta spent its launch drawing the other way. One computer per account. Shared cookies, shared files, shared command-line credentials. Separate screens, and those screens are work surfaces. A Bot reaches your own laptop only under a local-computer policy, and only with an approval.
| Muse | Grok Bot | |
|---|---|---|
| What you get | One personal agent | A roster of named Bots |
| The computer | A VM dedicated to you | One cloud computer for the whole account |
| Who may send or pay | A Sentinel the agent cannot override, then you | The Bot, then you, when the step needs approval |
| Where credentials live | Outside the agent's cell. The model sees a surrogate | On the shared computer, visible to every Bot |
| Where you talk | Muse app, WhatsApp, muse.ai | The Grok Bot app, on desktop and on mobile |
| The model | Muse Spark | Grok |
| Who it is for, at launch | People in the US, including inside WhatsApp | Paid Cursor and SuperGrok subscribers |
Muse is one relationship: your goals, your inbox, a grocery list from a saved Instagram reel, the example Meta uses. Grok Bot is a small team that shares a login on purpose. The computer is the difference.
What to connect
The newsroom title calls Muse the world's first personal AI agent built for everyone. OpenClaw had been a personal agent on people's own hardware since late 2025, and Grok Bot had been in beta since August. The body of Meta's post matches the launch better: no learning curve, WhatsApp and a dedicated app, the US first. A Secure VM per person is what makes that distribution imaginable. Grok Bot's bet is the roster, for people already on Cursor or SuperGrok.
Sheasha uses "personal superintelligence" for the internal feel of it, an agent that knows you and works in the background. The rest of his post is the harness. Whose computer it runs on is what decides whether people leave it connected.
Connect Muse for one agent in WhatsApp and a Sentinel between that agent and the network. Read the safety post before you connect email. Connect Grok Bot for teammates that share context on purpose, and keep a credential off that computer when a second Bot should be unable to use it.
The other two agents in this set, both of which you run yourself, are Hermes and OpenClaw.
Either Muse or Grok Bot can open a repository and attempt a fix. The review of the diff is a narrower job, and it wants a tool that stays on the pull request. ThinkReview does that on GitHub, GitLab, Azure DevOps, and Bitbucket.